8 minute read
Digital Danger
Strategic Vision vol. 9, no. 47 (September, 2020)
Lack of public understanding hinders Taiwan’s defense against cyber threats
Advertisement
Tobias Burgers, Hon-min Yau, & David J. Farber
The Republic of China (ROC) military band performs for the public on Double Ten Day in Taipei.
photo: Taiwan Presiential Office
Afew decades ago, political warfare, propaganda operations, and actual covert military attacks below the threshold-of-war were conducted in many physical domains. The focus has now shifted to cyberspace. This is a logical progression: The cyber domain is not hindered by geographical boundaries and obstacles, and encompasses the ability to hide one’s physical location to avoid the consequences of attribution. This makes the cyber domain the ideal theater in which to conduct operations. Military targets still matter, yet increasingly, civilian facilities have now become acceptable targets for offensive cyber operations.
Cyber attacks remain an ambiguous concept. In 2010, when General Keith Alexander of the US military’s Cyber Command testified to Congress that “Every day, America’s armed forces face millions of cyber attacks,” he was actually combining everything from software probing and computer-address scanning to a simple “computer ping.” As Singer and Friedman pointed out in their 2014 book, Cyber security and Cyberwar: What Everyone Needs to Know, cyber attacks often bundle together a variety of activities, simply because they involve Internet-related technology. Hence, scholars like Thomas Rid have argued strongly that no past or current cyber attacks meet Clausewitz’s definition of armed conflict. However, arguing what could be legitimately recognized as a cyber attack will cause people to fail to distinguish the forest for the trees. Whatever conception people take to investigate cyber threats will not deny the continuous escalations of cyber problems. Cyber attacks can range from kinetic to non-kinetic, and soft-kill to hard-kill. These new forms of threat are creating actual damage to human society.
A new front line
From digital propaganda to fake news, and from theft of private data to hacking attacks against civilian infrastructures such as banks, hospitals, and other essential civilian institutions, the human, non-military domain has become a front line in the conduct of cyber operations. Despite these new developments, the perception among those who are now on the front lines—the population—is that they don’t seem to view cyber attacks as a high priority. To put it bluntly, those on the new front lines do not seem to think they are at risk in this new type of war.
Such is the case in Taiwan, as well. During the 2020 presidential elections, the issue of cyber-threats was a prominent election theme. In particular, the issue of so-called fake news (also known as misinformation and disinformation) was an issue of importance within the larger electoral debate. Chinese efforts to influence media operations and produce fake news via digital means, with the aim of influencing electoral outcomes, seem to have backfired. As such, one could expect that the Taiwan public would have an adequate, well-established understanding of cyber threats, and how this has become part of this new front line in the cross-strait conflict. Yet, in the first survey conducted by the Cyber Civilization Research Center (CCRC) at Keio University in Japan, which assessed the Taiwan public’s perception of cyber threats, the results seem to indicate that the issue of cyber threats has faded into the background rather quickly. To facilitate the need for communication, the survey was conducted using a scenario to consolidate respondents’ diverse conceptions of cyber attacks to the same foundation by referring to the attacks on critical infrastructure as defined by Taiwan’s 2018 Cyber Security Management Act. However, just half a year after the elections took place, when asked
A B-1B Lancer from Ellsworth Air Force Base, South Dakota, launches in support of a deployment to Andersen Air Force Base in Guam.
photo: Quentin Marx
about their fear and the likelihood that serious cyber attacks could occur in which the population would see a noticeable effect in the cyber and physical domain, most respondents were only “somewhat worried” about cyber attacks. This is true despite a majority acknowledging that cyber attacks (with a considerable impact) were likely or very likely. This seems to indicate that there is a disconnect between understanding the probability of cyber threats and understanding the possible impact of cyber threats. In brief, the first survey indicates that public risk perception in Taiwan about cyber threats seems flawed.
Given the issue of cyber threats during the election, that seems a remarkable and surprising result. Clearly, in the age of COVID-19, environmental issues, the decline of Hong Kong, and increased Chinese pressure on Taiwan’s borders, cyber threats have slipped under the public’s radar. Yet despite this, the comparison between the two surveys indicates that there is a clear perception gap about the actual cyber-threat situation facing Taiwan (which is severe), as well between what the public believes and what experts within Taiwanese academia and government know to be true.
This observation is illustrated throughout the second survey, which is a separate survey jointly conducted by the CCRC with the Graduate Institute of Strategic Studies, National Defense University, and the Taiwan Center for Security Studies at National Chengchi University.
The aforementioned gaps in perception raise significant contradictions which must be addressed. Taiwan society is already highly digitized, holding one of the highest internet usage rates globally. Smartphone use has also proliferated extensively. The ROC government has used technology extensively in its policy, in particular in a highly successful approach to the COVID-19 issue, and it will only do so more in the near future with the integration of technologies that are closely associated with the 4th industrial revolution, including AI, big data, and deep learning, among others.
While ICT technologies contribute to the well-being and well-functioning of Taiwan society, they also increase the risk and vulnerability of a society, its government, and the nation overall. In an area in which the (cyber) front lines include a growing array of civilian targets, such a disconnect is a worrisome development.
Cyber risks are likely to increase, yet the surveys have indicated that the public has not yet caught up to the reality in which cyber threats are of high importance. The disconnect between the public, experts, and reality, pose risks and challenges for the ROC government. There is the potential for Taiwanese citizens to become stuck on the front lines, unaware of new dangers, and how to react to their new position on this digital battlefield.
The discussion of cyber security involves political debates, strategic calculations, as well as a lot of technical knowledge—knowledge that does not always exist among the general public. As a result, misguided
arguments based on the public’s insufficient understanding of the cyber threat can make it difficult for a democratic society to forge the necessary political momentum and mandate an administration to develop the right set of capabilities.
ROC Vice President Lai Ching-te speaks at the Hacks in Taiwan (HITCON) event, which is a highly technical security conference held in Taiwan.
photo: ROC Presidential Office
Other historical narratives on the introduction of novel technologies into the national security domain can serve as an example: During the height of the Cold War and the development of nuclear strategy, the United States was able to invite public contributions from universities and think tanks to correct such deficits in understanding among the public. Ideas about nuclear warfare from researchers like Herman Kahn and his infamous escalation ladders, which defined 44 rungs on a metaphorical ladder of escalating conflict, were often considered controversial, but they still provided a bridge to allow dialogue between the general public, policymakers, and nuclear technocrats.
Likewise, the result of the above survey indicates that there is a perception gap between political elites and the general public. Cyber security, in its current state in Taiwan, is simply not well-understood, and remains under-studied. As such, there is a need for a continuous initiative to ensure that the Taiwan public is aware of existing and future cyber threats, and the consequences of such threats should they become a reality. This initiative should also invite participation from both strategists and computer experts to reduce the current knowledge gap.
Such a combined initiative would ensure that Taiwan society understands the new digital security environment in which it finds itself in the 21st century. As such, the surveys cited above that measure the public threat perception represent a first step toward encouraging such an initiative. While worthwhile, and confirming the hypothesis that a knowledge gap exists between experts and the broader public, as well as between cyber security reality and public perception, the survey reveals a need for further, long-term research on this subject. In particular, it is also crucial for scholars to understand how and by what means the public and expert community would react to cyber attacks, and these views could be subject to change as a result of geopolitical dynamics between China and Taiwan.
In democratic nations such as Taiwan, public opinion plays a role of significant importance in decision making. At the same time, expert thinking will further influence top-level decision making. Understanding both of these factors will help provide better insight into the decision-making process during a cyber crisis. With the public now on the front lines of digital conflict, scholars in Taiwan need to ensure that they can understand, and educate the Taiwan public on, cyber security and its respective role. This will go a long way toward ensuring that it will not become a tripwire in a digital conflict that would trigger a series of political explosions, threatening the security of the island and stability of cross-strait relations.
Dr. Tobias Burgers is a project assistant professor at the Cyber Civilization Research Center, Keio University.
Dr. Yau, Hon-Min is an assistant professor at the Graduate Institute of Strategic Studies (GISS), National Defense University (Taiwan).
Prof. David J. Farber is a distinguished professor at Keio University, and the co-director of the Cyber Civilization Research Center.
